poc3

2026-08-15 23:43:58 +02:00
parent 71b6c0d86f
commit e8e5515e24
27 changed files with 861 additions and 64 deletions
@@ -71,6 +71,8 @@ outputs:

  # Bounded forensic capture: only flows that generated an alert are kept.
  # The eight 64 MB files cap disk use at roughly 512 MB inside /data/logs/suricata.
+  # Runtime startup rewrites this block from FORENSIC_PCAP_MODE.
+  # blocks/off disable Suricata PCAP logging; blocks is persisted by the app only after successful RouterOS blocks.
  - pcap-log:
      enabled: yes
      filename: alert.pcap